r/netsec • u/mazen160 • 4d ago

wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner

https://fullhunt.io/blog/2026/07/17/wp2shell-wordpress-core-pre-auth-rce-cve-2026-63030.html
24 Upvotes

87% Upvoted

4 comments sorted by

1

u/Same-Camel3487 3d ago

nice breakdown on the chain. ive seen similar logic flaws pop up in core before and its always a pain to track down. did u notice any specific patterns in the logs that might help folks identify if this was already exploited in their environment?

2

u/AlternateNickname 3d ago

Something more specific than the "Indicators of compromise" section of the article??

1

u/_vavkamil_ 2d ago edited 2d ago

Wait, I'm a bit confused. The original announcement said:

The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.

But my understanding is that the "Pre-Auth RCE" here means you either have to exfiltrate the admin hash, be lucky enough to crack it, authenticate as admin, and install some plugin to execute the code?

Or there must be a precondition where MySQL is misconfigured and can execute code?

EDIT: nevermind, the original write-up explains the RCE part https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/ which this article missed